Fix: apply low-s s
flips also to v
on ecdsa signature shares combination
#750
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
This PR corrects the low-s rule by linking the
s
flips with thev
value when combining ecdsa signaturesWhen the multiple shares are combined and the final signature created, if the
s
value is in the top half of the curve order, then it is flipped. However that flip also had to flip thev
value. With the changes in this PR now we are doing thatv
flipThe signature was always valid as it is composed of the
(r,s)
tuple without caring of whichs
value (positive or negative) was used. But, when trying to recover the public key or address of the signer, we need the correctv
value and having it unlinked from the s flips created a situation where a signature could recover a wrong public address unless the consumer knows the result already and fixes thev
value itselfType of change
How Has This Been Tested?
Please describe the tests that you ran to verify your changes. Provide instructions so we can reproduce. Please also list any relevant details for your test configuration
Checklist: